tmpvix8_sw7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmpvix8_sw7
Size

470KB
MD5

ab92e0245606be9f429c5dd42eabb8cf
SHA1

12ee90b2ff5c561848abd2d7f901b487f1616ccd
SHA256

4ed603d9817640a377d756c8dbec8bc63a10fdb3eb3b7f1cbff4f653d2e9988b
SHA512

5a5f79308f8086ac82893557517d5a49c5fc0d7ba459168b21b8e5855f463f569375eda1919b38dfcaaaf2a4d76284eaad0201283bd6ef69a76c0d4f1c10cca7
SSDEEP

12288:49vis3fPYd4QeEcOouBQKjC6UfHlf8VETpBe:4wsPPS5FcKm6UdfGN

Score

1^/10

Malware Config

Signatures

Files

tmpvix8_sw7
.dll windows:6 windows x64 arch:x64

a7237948c9a5b4a8c4d83ab017b31def

Code Sign

51:ca:00:98:16:fd:bd:80:f1:20:e0:15:ee:75:82:3e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/12/2013, 00:00

Not After

22/12/2016, 23:59

Subject

CN=Oracle Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=VirtualBox,O=Oracle Corporation,L=Redwood Shores,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:da:c0:e5:de:9a:96:a5:13:21:09:0d:b2:7e:0b:a1:e1:f7:92:ec
Certificate

Issuer

CN=VirtualBox for Legacy Windows Only Timestamp CA SHA1,O=Oracle Deutschland B.V. & Co. KG,L=Munich,ST=Bavaria,C=DE

Not Before

01/01/2014, 00:00

Not After

31/12/2014, 23:59

Subject

CN=VirtualBox for Legacy Windows Only Timestamp Kludge 2014 SHA1,O=Oracle Deutschland B.V. & Co. KG,L=Munich,ST=Bavaria,C=DE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:52:65:06:cc:82:88:11:7d:a6:be:d3:a5:ab:ec:20
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/02/2021, 00:00

Not After

16/04/2024, 23:59

Subject

CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:08:7c:dc:81:a4:45:67:d0:77:32:ed:1c:6a:31:58:2a:de:88:b2:fa:a7:c0:83:89:b5:e9:b8:01:28:21:43
Signer

Actual PE Digest

7b:08:7c:dc:81:a4:45:67:d0:77:32:ed:1c:6a:31:58:2a:de:88:b2:fa:a7:c0:83:89:b5:e9:b8:01:28:21:43

Digest Algorithm

sha256

PE Digest Matches

true

7e:29:0c:cb:ce:1f:59:9c:f2:6a:9a:61:5b:69:24:fb:be:6c:a6:fb
Signer

Actual PE Digest

7e:29:0c:cb:ce:1f:59:9c:f2:6a:9a:61:5b:69:24:fb:be:6c:a6:fb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxNetNAT\VBoxNetNAT.pdb

Imports

vcruntime140

__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
strstr
memcpy
memmove
_purecall
strchr
memset
memchr
__std_type_info_destroy_list
__C_specific_handler
memcmp

vcruntime140_1

__CxxFrameHandler4

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vboxrt

SUPR3Init
SUPR3Term
SUPR3IsDriverless
SUPR3CallVMMR0Ex
SUPR3LoadVMM
RTNetIPv4HdrChecksum
RTNetIPv4PseudoChecksum
RTNetIPv6PseudoChecksumEx
RTNetUDPChecksum
RTNetTCPChecksum
RTStrNICmp
RTStrStr
RTStrToUInt16Ex
RTAssertMsg2Weak
RTRandU32
RTMemAllocTag
RTTimeMilliTS
RTSemEventCreate
RTSemEventDestroy
RTSemEventSignal
RTSemEventWait
RTSemEventMultiCreate
RTSemEventMultiDestroy
RTSemEventMultiSignal
RTSemEventMultiReset
RTSemEventMultiWait
RTSemMutexCreate
RTSemMutexDestroy
RTSemMutexRequest
RTSemMutexRelease
RTThreadCreateF
RTMemReallocTag
RTReqQueueCreate
RTReqQueueProcess
RTReqQueueCallEx
RTStrFormat
RTStrFormatTypeRegister
RTStrICmp
RTMsgErrorExit
RTUtf16ToUtf8ExTag
RTAssertShouldPanic
RTStrNLen
RTStrFormatV
RTStrToUtf16ExTag
RTStrCalcUtf16LenEx
RTPathAppPrivateArch
RTLdrGetSymbol
RTLdrLoad
RTBldCfgVersion
RTLogFlush
RTLogSetBuffering
RTLogCreateEx
RTLogRelSetDefaultInstance
RTTimeNow
RTTimeSpecToString
RTProcGetExecutablePath
RTProcSelf
RTSystemQueryFirmwareBoolean
RTSystemFirmwareTypeName
RTSystemQueryFirmwareType
RTSystemQueryDmiString
RTMsgError
RTPrintf
RTUuidClear
?cleanup@RTCString@@IEAAXXZ
?isNotEmpty@RTCString@@QEBA_NXZ
?isEmpty@RTCString@@QEBA_NXZ
?c_str@RTCString@@QEBAPEBDXZ
?appendPrintf@RTCString@@QEAAAEAV1@PEBDZZ
?printfV@RTCString@@QEAAAEAV1@PEBDPEAD@Z
??4RTCString@@QEAAAEAV0@PEBD@Z
??1RTCString@@UEAA@XZ
??0RTCString@@QEAA@PEBDPEAD@Z
??0RTCString@@QEAA@PEBD@Z
??0RTCString@@QEAA@XZ
RTUtf16Cmp
RTUtf16Len
RTStrToUInt32Ex
RTStrCopy
RTStrStripL
RTStrPrintf
RTStrDupTag
RTStrFree
RTStrUtf8ToCurrentCPTag
RTCritSectDelete
RTCritSectLeave
RTCritSectEnter
RTCritSectInit
RTThreadWait
RTThreadCreate
RTMemFree
RTAssertMsg1Weak
RTPathExecDir
RTPathAppend
RTProcShortName
RTGetOptPrintError
RTGetOpt
RTMemDupTag
RTMemAllocZTag
RTLogLoggerEx
RTLogRelGetDefaultInstanceEx
RTSystemQueryAvailableRam
RTSystemQueryTotalRam
RTSystemQueryOSInfo
RTBldCfgTargetDotArch
RTPathUserHome
RTPathStartsWithRoot
RTPathAbs
RTDirCreateFullPath
RTDirExists
RTEnvGetEx
RTNetStrToIPv6Cidr
RTNetStrToIPv6Addr
RTNetPrefixToMaskIPv4
RTNetStrToIPv4Cidr
RTNetStrToIPv4Addr
RTNetStrToIPv4AddrEx
RTGetOptInit
RTThreadSelf
RTBldCfgRevision
RTUuidIsNull
RTUuidFromUtf16
RTErrConvertFromWin32

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
_initialize_narrow_environment
_configure_narrow_argv
perror
_cexit
_initterm
_initterm_e
_execute_onexit_table
_initialize_onexit_table
__sys_nerr
strerror_s
_errno
_seh_filter_dll
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strncmp
_strdup
strcmp

api-ms-win-crt-stdio-l1-1-0

_read
__stdio_common_vfprintf
_open
__stdio_common_vsprintf
_close
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
malloc
free

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32

kernel32

SetUnhandledExceptionFilter
IsDebuggerPresent
FormatMessageW
GetCurrentProcess
TerminateProcess
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetVersionExW
GetLastError
UnhandledExceptionFilter
FormatMessageA
LocalFree
GetModuleHandleW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThread
DuplicateHandle
CloseHandle
GetProcAddress
GetModuleHandleExW
VirtualProtect
CreateMutexW
SetLastError
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
ExitProcess

user32

PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
MsgWaitForMultipleObjects

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ws2_32

sendto
WSASend
WSARecv
shutdown
getpeername
recvfrom
WSASetLastError
setsockopt
listen
WSACreateEvent
WSAEnumNetworkEvents
freeaddrinfo
WSAResetEvent
getsockopt
ioctlsocket
connect
bind
WSAGetLastError
send
recv
closesocket
WSAStartup
socket
getaddrinfo
WSAEventSelect
WSAWaitForMultipleEvents
getsockname
WSASocketW
accept
WSASendTo

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
StringFromIID
CoInitializeSecurity
CoCreateFreeThreadedMarshaler

oleaut32

SysAllocStringByteLen
SysStringLen
SysFreeString
GetErrorInfo
SysAllocStringLen
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayRedim
SafeArrayDestroy
SysReAllocStringLen
SafeArrayCreate

rpcrt4

CStdStubBuffer_Invoke

iphlpapi

Icmp6ParseReplies
IcmpParseReplies
Icmp6SendEcho2
IcmpSendEcho2
Icmp6CreateFile
IcmpCreateFile

Exports

Exports

TrustedMain

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7237948c9a5b4a8c4d83ab017b31def

Code Sign

51:ca:00:98:16:fd:bd:80:f1:20:e0:15:ee:75:82:3eCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

20:da:c0:e5:de:9a:96:a5:13:21:09:0d:b2:7e:0b:a1:e1:f7:92:ecCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

0f:52:65:06:cc:82:88:11:7d:a6:be:d3:a5:ab:ec:20Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

7b:08:7c:dc:81:a4:45:67:d0:77:32:ed:1c:6a:31:58:2a:de:88:b2:fa:a7:c0:83:89:b5:e9:b8:01:28:21:43Signer

7e:29:0c:cb:ce:1f:59:9c:f2:6a:9a:61:5b:69:24:fb:be:6c:a6:fbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcruntime140

vcruntime140_1

msvcp140

vboxrt

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

kernel32

user32

advapi32

ws2_32

ole32

oleaut32

rpcrt4

iphlpapi

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 134KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 2KB - Virtual size: 6.5MB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 249KB - Virtual size: 248KB

.reloc Size: 1KB - Virtual size: 1KB

51:ca:00:98:16:fd:bd:80:f1:20:e0:15:ee:75:82:3e
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

20:da:c0:e5:de:9a:96:a5:13:21:09:0d:b2:7e:0b:a1:e1:f7:92:ec
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

0f:52:65:06:cc:82:88:11:7d:a6:be:d3:a5:ab:ec:20
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

7b:08:7c:dc:81:a4:45:67:d0:77:32:ed:1c:6a:31:58:2a:de:88:b2:fa:a7:c0:83:89:b5:e9:b8:01:28:21:43
Signer

7e:29:0c:cb:ce:1f:59:9c:f2:6a:9a:61:5b:69:24:fb:be:6c:a6:fb
Signer

.text
Size: 135KB - Virtual size: 134KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 2KB - Virtual size: 6.5MB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 249KB - Virtual size: 248KB

.reloc
Size: 1KB - Virtual size: 1KB